FAIR CREDIT REPORTING CASES ILLUSTRATE RISKS FOR CREDIT REPORTING
AGENCIES, CREDITORS, AND LAWYERS

I. Introduction

Congress enacted the Fair Credit Reporting Act (FRCA) in 1970 to promote efficiency in the banking system and to protect consumer privacy. This article describes selected cases that illustrate risks under the FRCA for credit reporting agencies, creditors, and lawyers.

II. FCRA Private Right of Action

In Dornhecker v. Ameritech Corporation, [FN1] the court held that the FCRA provides individual consumers with a private right of action against a furnisher of credit information for failing to properly comply with its investigative duties once it has received notice of a dispute from a credit reporting agency. Three plaintiffs, who were consumers as defined by the FCRA, alleged that Ameritech opened phone service accounts on behalf of third persons who fraudulently used plaintiffs' names and other identifying information, and thus allowed debt to be falsely incurred in their names. Plaintiffs alleged that because Ameritech failed to appropriately screen account applicants, it opened accounts on behalf of third persons who used plaintiffs' personal identifiers to receive services from Ameritech. Plaintiffs never received these services. Ameritech eventually enlisted the aid of collection agencies and reported the bad debt to credit reporting agencies. Ameritech requested dismissal of plaintiffs' FCRA claims, saying that there was no private right of action under the section of the FCRA requiring furnishers of information to investigate disputed credit information. Analyzing the case under the four-factor test set forth by the Supreme Court in Court v. Ash [FN2] for determining whether a private remedy is implicit in a statute not expressly providing for one, the court held that individual consumers do have a private right of action against a furnisher of information under the FCRA. [FN3]

The four factors highlighted in Ash are: (1) whether the plaintiff is a member of the class for whose benefit the statute was enacted; (2) whether the legislative history indicates any legislative intent, explicit or implicit, either to create or deny such a remedy; (3) whether the implication of a private remedy would frustrate the underlying purposes of the legislative scheme; and (4) whether the cause of action is one traditionally relegated to state law. [FN4]

The court found that two of the plaintiffs were members of the protected class, stating that the FCRA was enacted to protect individuals from inaccurate or arbitrary information in a consumer report. The court next looked at the legislative history and found that Congress did not intend to limit civil liability under 15 U.S.C. section 1681s-2(b). The court also found that a private remedy does not frustrate the purpose of the FCRA's scheme, noting that other provisions of the FCRA provide consumers with a private right of action. Lastly, Congress expressly intended for the FCRA to co-exist with state consumer protection laws.

The other issue on which the Dornhecker court focused was whether the FCRA preempted common-law claims of negligence, invasion of privacy, *69 and defamation. Even though the plaintiffs' claims for such torts were dismissed for failure to state a cause of action, the court addressed this issue to eliminate the need to re-argue motions to dismiss the state law claims. The court held that 15 U.S.C. section 1681s-2 regulates the responsibilities of persons who furnish information to consumer reporting agencies. Common law tort claims, such as those alleged by the plaintiffs, may not fairly be characterized as imposing any requirement or prohibition on persons who furnish information to consumer reporting agencies, other than the general standard of reasonable care such claims impose upon all persons. Additionally, the court said that the negligence claims encompassed Ameritech's alleged breach of duty committed by opening accounts based on stolen information, which are actions not regulated by the FCRA. Thus, the court held that the common law causes of action are not pre-empted by the FCRA, 15 U.S.C. section 1681t(b)(1)(F).

In Geeslin v. Nissan Motors, [FN5] the court ruled that the 1996 FCRA amendment allowed a claim on the FCRA duty to update and correct information, but recognized no claims that arose prior to September 30, 1997. Campbell v. Baldwin [FN6] involved a case where the court ruled that furnishers of information who violated 15 U.S.C. section 1681s-2(b) are not exempt from civil liabilities.

In Carney v. Experian, [FN7] the court held that furnishers of information who violated section 1681s-2(b) owe a duty to credit reporting agencies and not to consumers. The case says that section 1681s-2(b) duties are triggered only on notice from a credit reporting agency.

In Ryan v. Trans Union Corp., [FN8] the plaintiff alleged that in 1996, after he and his former wife separated, she impermissibly used his personal information to get credit cards issued to her in his name and made charges on those accounts, which were not paid. He alleged that he notified the card issuers but they refused to correct the blemishes on his accounts and credit reports. He alleged that the credit card issuers violated the FCRA by furnishing and then failing to correct this inaccurate account information. The court found that while 15 U.S.C. section 1681s-2(b) permits private parties to sue providers of information, citing Dornhecker, the duties imposed on providers of information arise only after the furnisher receives notice from a consumer reporting agency that a consumer is disputing credit information. However, 15 U.S.C. section 1681s-2 became effective on September 30, 1997, and these incidents took place in 1996, so the plaintiff's case was moot.

The Ryan court also discussed the plaintiff's allegation of negligent non-compliance with the FCRA. Section 1691o(a) says that any person who is negligent in failing to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer for damages and costs. The court said that the FCRA does not give rise to claims for the negligent issuance or acceptance of credit card applications. Instead, it covers inaccurate or misleading disclosures of information to credit reporting agencies. Additionally, providers of information like the credit card issuer defendants are accountable only if they continue to supply inaccurate data to credit reporting agencies after notification. Thus, they were not liable for negligence. The court held that since there is no other basis under the FCRA to impose liability on a provider of information, the plaintiff had no claim under the FCRA for the defendant's alleged negligence in issuing credit cards to his then-estranged wife.

In Olexy v. Interstate Assurance Co., [FN9] the plaintiff asserted various claims for: willful, malicious and intentional interference with contract, business relation and prospective advantage; fraud; defamation; intentional infliction of emotional distress; and violation of the FCRA. The plaintiff contended that the defendant published and reported a false claim of indebtedness to a credit reporting agency. The court found that the cause of action could be read as being asserted under 15 U.S.C. section 1681s-2(b), which imposes a duty to investigate and report incomplete or inaccurate information to consumer reporting agencies upon notice of a dispute. The court also affirmed that there is a private right of action by a consumer for a violation of such subsection, citing Dornhecker. Thus, the court denied the defendant's motion to dismiss for lack of standing.

III. Novel Theories Are Being Advanced

In Washington v. CSC Credit Services, Inc., [FN10] a group of consumers sued consumer reporting agencies for allegedly violating the FCRA by furnishing credit reports to insurers for impermissible purposes. One plaintiff was severed from the class, because her claims were distinct from the others. This case deals with that plaintiff's claim. In this case, the husband of that plaintiff was also a member of the class. She alleged that because her name, social security number, and accounts held jointly with her husband were listed on the husband's credit report, her rights had been violated under the FCRA.

The Washington court found that the document in question was not a consumer report under the FCRA. The FCRA defines "consumer report" as "any written, oral or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living." The actual credit report in this case was the husband's individual credit report, and the joint accounts it listed did not indicate that the wife was the other holder of *70 the account. The court found that the husband's credit report was not transformed into the wife's credit report just because it gave her name and social security number.

Thus, the Washington court found that even though a wife has standing to bring suit against a consumer reporting agency for failure to follow reasonable procedures to assure the maximum possible accuracy of information in her husband's consumer report, such standing only exists where the release of inaccurate information in the husband's report negatively affected the wife's credit worthiness. Therefore, because the credit reporting agencies never released the wife's credit report, only her husband's, and because the wife lacked standing to challenge the release of the husband's report (for the reason that she was unable to demonstrate damages as a result of the release), the court did not reach the question of whether the report was released in violation of the FCRA.

IV. As These Cases Illustrate, Identity Theft Litigation Is Increasing

In Gill v. Kostroff, [FN11] the plaintiff opened a credit card account with one of the defendants, First Card, which she closed about five months later. Shortly after she closed the First Card account, she alleged that First Card issued a fraudulent account to an unknown person using plaintiff's identification information. First Card wired approximately $20,000 from the fraudulent credit card account, even after being informed by the plaintiff that the account was fraudulent and plaintiff was being victimized. Consequently, the plaintiff alleged that false information was reported to various credit reporting agencies, and First Card harassed and made threatening phone calls to plaintiff. The plaintiff sued various defendant credit reporting agencies for her mental anguish, emotional distress, lost wages and damage to her reputation. The court denied the defendant's motion for summary judgment.

The Gill court said that while normally the two year statute of limitations begins to run at the time the credit reporting agency violates the FCRA, when a defendant materially and willfully misrepresents, to the consumer, information that was required to be disclosed to the consumer, the statute of limitations runs from the point the consumer gained knowledge of the violation. The court denied the motion for summary judgment since statute of limitations questions are questions of fact for the jury.

Defendant Trans Union argued on summary judgment that the plaintiff was unable to show that the defendant failed to maintain reasonable procedures to assure maximum possible accuracy in reporting the alleged incorrect information on plaintiff's credit report. This argument was rejected by the court. Under the FCRA, a consumer credit reporting agency is required to maintain reasonable procedures, i.e., those that a reasonably prudent person would undertake under the circumstances. While a credit reporting agency is entitled to rely on the reports issued by a credit grantor, a credit reporting agency cannot ignore notice given by a consumer that information contained within the credit report is erroneous. Although a credit reporting agency may initially rely on reports provided by credit grantors and public court documents, exclusive reliance on such information after a dispute has been conveyed is not reasonable or justified.

The Gill court held that the plaintiff was entitled to allege damages for pain and suffering where a defendant credit reporting agency has actually issued credit reports to a user and where those credit reports are used to deny the plaintiff's later application for credit. However, the court did not allow plaintiff to claim punitive damages because she needed to prove that the credit reporting agency acted willfully, which meant to show it knowingly and intentionally committed an act in conscious disregard for the rights of others. Mere conclusions by the plaintiff were insufficient. In DiMezza v. First USA Bank, [FN12] Michael DiMezza (DiMezza) claimed that he was the victim of identity theft. DiMezza applied for and was denied a credit card by First USA in 1997. DiMezza learned that another person opened a credit card account and incurred a debt under the name "Nick DiMezza" with his social security number, but a different address. Shortly after this discovery, DiMezza sent a letter to First USA informing it that someone had stolen his identity and disputing that he was Nick DiMezza. Along with the letter, DiMezza sent his birth certificate, notarized signature, passport and social security card. Later, First USA sold the account to NACC for collection. DiMezza continued to dispute the debt with NACC. DiMezza claimed that NACC and First USA failed to investigate his dispute, failed to review all relevant information provided by him and failed to notify consumer reporting agencies that information about the debt was inaccurate. NACC moved to dismiss and argued that DiMezza had no cause of action under the FCRA because the duties articulated therein are owed to a consumer reporting agency and not to an individual consumer. Alternatively, NACC argued that even if the duties articulated in the FCRA are owed to consumers, they are triggered only upon receipt of a notice of claim by the furnisher of information from the consumer reporting agency.

In DiMezza, the court held that the FCRA provides a private right of action for consumers to enforce the investigation and reporting duties imposed on the furnishers of information and found that DiMezza had sufficiently alleged NACC's receipt of notice of the dispute.

TRW v. Andrews [FN13] involved a case where the United States Supreme Court (Court) considered the statute of limitations for suits based on the FCRA. *71 On June 17, 1993, the plaintiff (Andrews) visited a radiologist's office in Santa Monica, California. She filled out a new patient form listing certain basic information, including her name, birth date, and social security number. Andrews handed the form to the office receptionist, one Andrea Andrews (the Impostor), who copied the information and thereafter moved to Las Vegas, Nevada. Once there, the Impostor attempted on numerous occasions to open credit accounts using Andrews' social security number and her own last name and address.

On four of those occasions, the company from which the Impostor sought credit requested a report from TRW. Each time, TRW's computers registered a match between Andrews' social security number, last name, and first initial and responded by furnishing her file. TRW disclosed Andrews' credit history at the Impostor's request to a bank on July 25, 1994, to a cable television company on September 27, 1994, to a department store on October 28, 1994, and to another credit provider on January 3, 1995. All recipients, except the cable company, rejected the Impostor's applications for credit. Andrews did not learn of these disclosures until May 31, 1995, when she sought to refinance her home mortgage and, in the process, received a copy of her credit report reflecting the Impostor's activity. Andrews conceded that TRW promptly corrected her file upon learning of its mistake. She alleged, however, that the blemishes on her report not only caused her inconvenience and emotional distress, they also forced her to abandon her refinancing efforts and settle for an alternative line of credit on less favorable terms.

On October 21, 1996, almost 17 months after she discovered the Impostor's fraudulent conduct and more than two years after TRW's first two disclosures, Andrews filed suit. Her complaint stated two categories of FCRA claims against TRW, only the first of which was relevant before the Court. Those claims alleged that TRW's four disclosures of her information in response to the Impostor's credit applications were improper because TRW failed to verify, predisclosure, that Andrews initiated the requests or was otherwise involved in the underlying transactions. Andrews asserted that by processing requests that matched her profile on social security number, last name, and first initial, but did not correspond on other key identifiers, notably birth date, address, and first name, TRW had facilitated the Impostor's identity theft. According to Andrews, TRW's verification failure constituted a willful violation of section 1681e(a), which requires credit reporting agencies to maintain "reasonable procedures" to avoid improper disclosures. She sought injunctive relief, punitive damages, and compensation for the "expenditure of time and money, commercial impairment, inconvenience, embarrassment, humiliation and emotional distress" that TRW had allegedly inflicted upon her.

TRW moved for partial summary judgment, arguing, inter alia, that the FCRA's statute of limitations had expired on Andrews' claims based on the July 25 and September 27, 1994 disclosures because both occurred more than two years before she brought suit. Andrews countered that her claims as to all four disclosures were timely because the limitations period did not commence until May 31, 1995, the date she learned of TRW's alleged wrongdoing. The District Court, agreeing with TRW that section 1681p does not incorporate a general discovery rule, held that relief stemming from the July and September 1994 disclosures was time-barred.

The Ninth Circuit reversed this ruling, applying what it considered to be the general federal rule that a federal statute of limitations begins to run when a party knows or has reason to know that she was injured. The Ninth Circuit rejected the District Court's conclusion that the text of section 1681p, and in particular the limited exception set forth in that section, precluded judicial attribution of such a rule to the FCRA. "[U]nless Congress has expressly legislated otherwise," the Ninth Circuit declared, "the equitable doctrine of discovery is read into every federal statute of limitations." [FN14] Finding no such express directive, the Ninth Circuit ruled that none of Andrews' injuries were stale when suit was brought. Accordingly, the Ninth Circuit reinstated Andrews' improper disclosure claims and remanded them for trial. An appeal followed to the Court. Section 1681e(a) of the FCRA requires credit reporting agencies, inter alia, to maintain reasonable procedures to avoid improper disclosures of consumer credit information. Section 1681p of the FCRA provides that an action to enforce any liability created under the FCRA must be brought "within two years from the date on which the liability arises, except that where a defendant has ... willfully misrepresented any information required under [the FCRA] to be disclosed to [the plaintiff] and the information ... is material to [a claim under the FCRA], the action may be brought at any time within two years after [the plaintiff's] discovery of the misrepresentation."

The Court said that a general discovery rule does not govern Section 1681p, which explicitly delineates the exceptional case in which discovery triggers the two-year limitation, and Andrews' case does not fall within the exceptional category.

The Court said that, even if the Ninth Circuit correctly identified a general presumption in favor of a discovery rule, an issue that Andrews did not oblige the Court to decide, the Ninth Circuit significantly overstated the scope and force of such a presumption. The Court also said that the Ninth Circuit placed undue weight on prior precedent, which stood for the proposition that equity tolls the statute of limitations in cases of fraud or concealment, but did not establish a general presumption in all contexts. The Court said that the only cases in which it had recognized a "prevailing" discovery rule, moreover, were decided in two contexts, latent disease and medical malpractice. The Court noted that lower *72 federal courts generally apply a discovery rule when a statute is silent on the issue, but the Court had not adopted that rule as its own. Further, the Court observed that it had never endorsed the Ninth Circuit's view that Congress can convey its refusal to adopt a discovery rule only by explicit command, rather than by implication from the particular statute's structure or text. Thus, even if the presumption identified by the Ninth Circuit exists, it would not apply to the FCRA, because the FCRA does not govern an area of the law that cries out for application of a discovery rule and was not silent on the issue of when the statute of limitations begins to run.

The Court reversed and remanded Andrews to the Ninth Circuit, which then affirmed the District Court's decision. In Bumgardner v. Lite Cellular, Inc., [FN15] the jury found that a cellular phone company willfully and negligently failed to comply with the FCRA by allowing a consumer's ex-wife to authorize a credit check on the consumer and to open an account in his name. Nevertheless, the court ruled that the consumer did not have a right to injunctive relief under the FCRA. The court emphasized that Congress had not provided for private injunctive relief in the FCRA itself and had expressly delegated enforcement of the FCRA to the FTC. Further, the court noted that even if it had the power to grant private injunctive relief under the FCRA, it would not grant such relief under the circumstances of the case.

In McCowan v. Mark Warner, [FN16] an Alabama jury awarded $1.85 million to a consumer, who complained several investment firms failed to prevent a clerk from stealing her identity. The plaintiff had hired an investment firm in 1993. According to the complaint, Walter B. Fairchild, a registered representative of Investacorp, operated Fairchild Investments. Investacorp was a broker-dealer headquartered in Florida. Mark Warner worked for Fairchild and had access to plaintiff's account information. In May of 1994, Fairchild discovered an illegal scheme operated by Warner to sell stock tips. When Fairchild learned Warner had pending arrest warrants against him, Fairchild fired Warner and changed the lock on his post office box. The plaintiff alleged that after Warner's dismissal, Warner applied for a Charles Schwab & Co. account in her name with information he obtained while working for Fairchild. Upon opening the account, Warner prepared a Schwab account transfer form to liquidate $29,290 from a mutual fund managed by Alger Shareholders Service. Schwab guaranteed the account transfer form and sent it to Alger. Alger, in turn, sent Schwab's check payable for the benefit of plaintiff to the imposter's account. Apparently, Warner had a female make a telephone request to Schwab to mail a check for all the proceeds to his address. Warner received the funds and deposited them into his own bank account.

When the plaintiff discovered the theft in 1995, she sued Schwab, Fairchild Investments, and Alger for not taking precautions that may have prevented Warner from converting her funds into his own. She requested punitive damages for the defendant's alleged reckless indifference to the possibility of identity theft.

In McCowan, Warner, Alger, and Schwab were held responsible for compensatory damages in the amount of $42,986. Fairchild and Investacorp were held responsible for nominal damages, but punitive damages were assessed against all the defendants: $1,000,000 was awarded against Warner, $700,000 against Schwab, $100,000 against Alger, $10,000 against Fairchild and $5,000 against Investacorp. Warner plead guilty to criminal charges and served two months in jail.

In Polzer v. TRW, [FN17] the plaintiffs alleged that they were the victims of identity theft and that the defendants facilitated and exacerbated the harm plaintiffs suffered. Plaintiffs had impeccable credit histories. The plaintiffs believed that their identities were stolen during the summer of 1994 by an imposter, who either copied, or obtained a copy of, a credit application they had submitted to a bank for a car loan. The imposter, armed with the plaintiffs' personal identification information, as well as all of their legitimate credit account numbers, quickly went to work changing their address at the plaintiffs' banks and at credit reporting agencies to an apartment in Manhattan. That change apparently was accepted by defendants without serious inquiry or requiring any proof that the plaintiffs had actually moved. The "fraud address" was then spread by the three major credit reporting agencies, which sold their names and new addresses to other banks seeking to offer them pre-approved credit cards. Those offers were sent to the imposter at the fraud address and the imposter had more than enough information to complete the applications and obtain the credit cards. The imposter ran up $100,000 in fraudulent charges. The plaintiffs were alerted to the fraud by one of their banks which noticed a dramatically different spending pattern. The plaintiffs immediately closed all of their credit accounts and began to rebuild their credit files. Unfortunately, the credit reporting agencies continued to sell the plaintiffs' name coupled with the fraud address to other banks offering them credit.

In Polzer, the appellate court ruled that banks are not liable for such negligence, even when they failed to take any steps whatsoever to confirm the applicant's identity and where they could have easily and inexpensively done so. The appellate court also rejected the plaintiffs' negligence claim and held that the banks did not have a duty to act more carefully. In doing so, the court rejected the plaintiffs' negligent enablement of imposter fraud claim. [FN18]

*73 V. Early Disposition Can Be Difficult

In Bruce v. First USA Bank, [FN19] a consumer brought an action against a credit card issuer and, among other things, alleged that the credit card issuer had violated the FCRA when it failed to properly investigate his claim that his former wife had fraudulently opened two accounts in his name and when it reported those accounts as delinquent. The court held that the reasonableness standard that applied to reinvestigations was applicable to the consumer's claims and, upon application of that standard, genuine issues of material fact existed as to whether the credit card issuer had negligently failed to comply with the investigation requirement. In the court's view, there was a factual dispute as to whether the information reported by the credit card issuer against the consumer was accurate.

In Bruce, two credit reporting agencies had notified the credit card issuer of the consumer's disputes regarding the credit card accounts reported as delinquent. The consumer had repeatedly insisted through telephone conversations and written correspondence that the accounts had been fraudulently opened in his name by his former wife. The credit card issuer's investigation consisted solely of a review of its own internal records. The credit card issuer's investigation revealed that the signatures on the credit card applications did not match the consumer's signature. The consumer's former wife was the only one ever to dispute a charge with respect to the credit cards. No one from the credit card issuer's investigation unit spoke with either the consumer or his former wife regarding the consumer's allegations. The consumer contended that he had never made a purchase with the credit card and had never made a payment toward any balance on the credit card.

VI. Law Firm Sued for FCRA Violations; Lawyer Beware

In McAnly v. Middleton & Reutlinger, [FN20] after learning that a law firm had obtained his credit report, the consumer sued the law firm, one of its partners, an associate, and a client claiming damages for violations of, among other things, the FCRA. At the urging of its client, the law firm requested the consumer's credit report in 1994. That request failed. The law firm tried again and received the consumer's credit report. The purpose of obtaining the consumer's credit report is unclear. The consumer did not discover the 1994 inquiry until some time in December of 1998. The consumer filed suit in early 1999. As to the FCRA claim, the law firm contended that it was barred by the FCRA's two-year statute of limitations. The consumer contended that the statute of limitations did not toll until the consumer discovers the act underlying his claim.

In McAnly, the court noted that the consumer could have discovered the 1994 inquiry within two years of its occurrence, but the consumer had no obligation to do so. Under the FCRA, there is no affirmative duty to periodically or continually monitor one's credit history or reasonable expectation that the consumer would do so. Until the December 1998 discovery, the consumer had no reason to suspect that anyone had improperly acquired his credit history. The court concluded that the consumer was not required to request and examine his credit history in order to demonstrate reasonable diligence. The court concluded that the consumer was not sleeping on his rights in any sense and that the two year statute of limitations would be tolled from the date of his actual discovery of the credit inquiry.

Bakker v. McKinnon [FN21] involved a 1996 suit by a dentist and his two adult daughters (collectively, the plaintiffs) against an attorney who represented several patients in dental malpractice actions against the dentist. The plaintiffs alleged that in violation of the FCRA, the attorney had requested several consumer credit reports about them in September of 1995 and April of 1996 from a local credit bureau. The district court entered judgment in favor of the plaintiffs. The attorney appealed.

The Eighth Circuit held that: (1) the credit reports on the plaintiffs were consumer reports within the meaning of the FCRA, regardless of the attorney's intended use of the credit reports; (2) the attorney did not have a legitimate business need to obtain the credit reports; and (3) the district court did not abuse its discretion in awarding the plaintiffs actual and punitive damages for the attorney's FCRA violations.

In Bakker, the Eighth Circuit held that regardless of the attorney's intended use of the credit reports, they were consumer reports within the meaning of the FCRA because the information contained therein was collected for a consumer purpose. Whether a credit report is a consumer report under the FCRA does not depend solely upon the ultimate use to which the information contained therein is put, but instead is governed by the purpose for which the information was originally collected in whole or in part by the consumer reporting agency. The 1996 FCRA amendments were not applicable and, as to the contention that the attorney had a legitimate business need for the credit reports, the court held that the attorney could not establish a legitimate business need within the meaning of the FCRA unless and until the attorney could prove or establish that she and the plaintiffs were involved in a business transaction involving a consumer. The attorney admitted that she and the plaintiffs were not involved in any consumer transaction involving the extension of *74 credit, insurance, employment, or licensing. Thus, no consumer relationship existed between the attorney (the party requesting the reports) and the plaintiffs (the subjects of the reports) and the business need exception did not apply. The court also rejected the attorney's argument that as an attorney representing clients in litigation, she had a business need to obtain credit reports on the opposing parties. The award of punitive damages was upheld because the attorney had obtained the credit reports in an attempt to exact a settlement and in pursuit of a vendetta against the plaintiffs and finding that the attorney had threatened the dentist with the loss of his profession.

VII. Other New Theories--Intrusion upon Seclusion

In Mlynek v. Household Finance Corporation, [FN22] the consumer alleged that he had received a telephone call in his Illinois home from a debt collector from the defendant's Florida office. According to the consumer, when he asked the debt collector about the purpose of the call, the debt collector yelled "You know who I am" and repeatedly told the consumer to get his checkbook and start writing "immediately" and "right now." The consumer terminated the call and reported the incident to his local police department as an extortion attempt.

The following day, the consumer returned another call from the debt collector and was again greeted with screaming. Following a request to speak to the debt collector's supervisor, the consumer was transferred to another person, who explained that the consumer allegedly owed the defendant $3,248 on a $2,500 unpaid loan on a check that was mailed to the consumer's house for a line of credit. The consumer also learned that while the defendant had obtained his correct social security number and place of employment through a copy of his credit report, the defendant's record of the consumer's address, date of birth, and birthplace were incorrect--the address that the defendant had was actually that of the consumer's son.

The consumer then discussed the loan with his son and called the debt collector's supervisor back and the supervisor replied that the consumer and his son had 15 minutes to straighten out the matter or "someone would go to prison over this." Later, the consumer obtained a copy of the loan check which listed his name and his son's on the front and bore two signatures on the back, neither of which belonged to the consumer. The consumer filed a multiple count complaint against the defendant and, among other things, alleged an unreasonable intrusion upon the seclusion of another. In Mlynek, the court explained that the Illinois Supreme Court had declined to recognize the tort of unreasonable intrusion upon the seclusion of another. Despite that declination, many Illinois appellate courts have recognized this tort. The court noted that this tort depends upon some type of highly offensive prying into the physical boundaries or affairs of another person. The basis of the tort is not publication or publicity. Rather, its core is the offensive prying into the private domain of another. The elements that must be pled and proven to state a cause of action for intrusion upon seclusion are: (1) an unauthorized intrusion or prying into the complainant's seclusion; (2) an intrusion that is offensive to a reasonable person; (3) the matter upon which the intrusion occurs is private; and (4) the intrusion causes anguish and suffering.

In Mlynek, the consumer claimed that the disturbing phone call he received from the debt collector and later discussions that he had with the debt collector and the debt collector's supervisor were sufficient to state a cause of action for intrusion upon his seclusion by the defendant. Nevertheless, the court held against the consumer. While receiving a phone call from an angry person claiming to be one's creditor is surely disturbing, the court did not believe that a reasonable person would find such an intrusion offensive. Also, of the three telephone conversations alleged, two were initiated by the consumer himself, making only one a truly unauthorized intrusion. Moreover, once the defendant was advised that the consumer had not signed the loan check, the defendant made no other calls to the consumer, making such calls hardly "persistent." For these reasons, the court held against the consumer on his claim of unreasonable intrusion upon the seclusion of another.

VIII. False Pretenses in Obtaining Credit Report

In Ali v. Vikar Management Ltd., [FN23] tenants sued a landlord to recover for violations of the FCRA in obtaining information from a credit reporting agency. The tenants moved for summary judgment and the district court held that: (1) the landlord, which lied to a credit reporting agency as to its reasons for assessing address information about the tenants in rate-stabilized apartments, obtained information under false pretenses; and (2) the mere presence of a landlord-tenant relationship does not permit a landlord to access a tenant's credit report to determine a rate-stabilized tenant's primary residence.

IX. Liability for Employees

In Kodrick v. Ferguson, [FN24] a credit reporting agency was not negligent under section 617 of the FCRA [FN25] when it did not prevent its employee from using agency facilities to obtain a credit report under false pretenses and for personal use without the express or implied approval of her supervisors. Although the FCRA is silent on agency liability, the court would neither fill in the agency gap with state law nor new federal common law imposing strict liability, noting that the FCRA preempts certain state causes of action arising out of acquisition and disclosure of consumer information and that the FCRA statutory scheme imposes, instead *75 of strict liability, only the duty to have reasonable reporting procedures under 15 U.S.C. section 1681e, subject to civil liability for negligent or willful noncompliance.

X. Vicarious Liability

In Jones v. Federated Financial Reserve Corp., [FN26] the court recognized that an employer may be liable for a negligent or willful violation of the FCRA based on an employee's "apparent authority" to obtain information from an individual's credit report. The consumer alleged that the company employee had improperly accessed her credit report information and that the employee had conveyed such confidential information to her former spouse. The lower court had refused to recognize the apparent authority doctrine as falling within the scope of the employer's exposure under the FCRA and reflected that thinking in its jury instruction on the consumer's FCRA negligence claim and in its directed verdict on behalf of the employer on the consumer's FCRA willful violation claim. However, the Sixth Circuit reversed the trial court and stressed that a recognition of the apparent authority doctrine was compatible with the stated purposes of the FCRA.

XI. False Pretenses

In Northrop v. Hoffman of Simsbury, Inc., [FN27] a consumer brought an action against an automobile dealership, dealership employees, and others who allegedly obtained her consumer credit report under false pretenses, asserting claims under the FCRA and the Connecticut Unfair Trade Practices Act. The consumer sought actual and punitive damages and injunctive relief. The defendants moved to dismiss for failure to state a claim. The court dismissed the claims arising under the FCRA and declined jurisdiction over the state law claim. The consumer appealed. On appeal, the court held that: (1) the consumer was not foreclosed from seeking relief under a provision of the FCRA that she failed to cite in her complaint; (2) a former FCRA provision imposing liability upon users of information that willfully failed to comply with any FCRA requirement encompasses a "requirement" not to obtain credit information under false pretenses; and (3) the consumer stated a claim under the FCRA.

XII. Debt Collection Employee

In Stevens v. First Interstate Bank, [FN28] the plaintiffs had accounts with the defendant. The defendant hired a debt collector, whom unbeknownst to the defendant had a previous criminal record and was, therefore, ineligible for employment by the bank. The collector failed to disclose that conviction on his employment application. After the defendant learned of the conviction, it fired the debt collector. However, the debt collector had allegedly stolen the plaintiffs' credit identity and run up a series of bad debts in their names. Although the plaintiffs were able to reverse the adverse credit reports without incurring significant economic harm, they alleged that they had suffered considerable emotional distress.

In Stevens, the trial court entered summary judgement against the plaintiffs. On appeal, the court framed the issue as follows: Where a third-party misappropriates personal or credit information that a depositor had provided to a bank, and that misappropriation is the result of the bank's failure to adequately protect the information from misappropriation, is the bank liable for the depositor's resulting emotional distress? The court said that the plaintiffs' claim against the bank was not a claim for "breach of confidentiality" because that tort required an affirmative disclosure of information by a person to whom the confidential information had been entrusted. The court said that this case was not about the bank's disclosure of information. Rather, this case dealt with the bank's alleged failure to protect information provided to it by a depositor from misappropriation by a bank employee acting outside the scope of his employment. The court noted that the plaintiffs had been unable to identify any authority that expanded the tort to impose liability where the defendant had not affirmatively disclosed the entrusted or confidential information. Further, the court rejected the plaintiffs' claim for the negligent infliction of emotional distress. The court said that, in the absence of a physical injury, to recover for emotional distress damages only, the plaintiffs must demonstrate that their relationship with the bank gave rise to some distinct legally protected interest beyond liability grounded in the general obligation to take reasonable care not to cause a risk of foreseeable harm to plaintiffs. The court said that the relationship between the plaintiffs, as depositors, and their bank was not of the type that Oregon courts have found gives rise to the requisite distinct legally protected interest.

XIII. Doctors Are Not Immune

In Lazar v. Trans Union, [FN29] Dr. Lazar sought a credit increase on his credit card. He was denied, however, based on a Trans Union credit report. After getting a copy of his credit report, Dr. Lazar discovered inaccurate and mismerged information from another "Gary Lazar" who was a convicted felon with numerous tax liens. Pursuant to Dr. Lazar's request, Trans Union removed the inaccurate information and provided him with a corrected report. Similar problems with inaccurate and mismerged information arose repeatedly over the next ten years. Each time Dr. Lazar discovered a problem, he notified Trans Union, which claimed to have corrected the problems. However, these errors resulted in Dr. Lazar being denied credit in several instances and being charged a higher interest *76 rate when he refinanced his mortgage.

Furthermore, in August of 1999, Dr. Lazar had difficulties leasing a car after nearly 50 separate incorrect entries appeared in his credit report. Dr. Lazar complained to Trans Union and was given a corrected copy of his report. In September of 1999, however, Dr. Lazar obtained another copy of his report and discovered that Trans Union was reporting the other "Gary Lazar" as a "possible additional consumer file" connected to Dr. Lazar's file. Dr. Lazar sued Trans Union under the FCRA and his complaint detailed a long history of inaccuracies in his credit report as prepared by Trans Union. Dr. Lazar alleged violation of the FCRA's provision that a credit reporting agency "shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates" and the FCRA's reinvestigation requirements. He also raised several state law claims.

The court concluded that all claims for conduct between 1990 and 1994 were barred by the FCRA's statute of limitations. Dr. Lazar argued that the discovery rules held the statute of limitations until he learned in 1999 that Trans Union had not corrected his report as it had claimed to have done. However, the court disagreed, stating that Dr. Lazar could not invoke the discovery rule exception for information that the FCRA did not require the defendant to disclose. Dr. Lazar's argument that Trans Union willfully misrepresented information about the deletion of inaccurate information was not the same as an allegation that information required to be disclosed was willfully misrepresented.

XIV. And if You Do Not Pay, I Will Send a Report to the Credit Bureau

In Epps v. Etan Industries, [FN30] a debt collector violated 15 U.S.C. sections 1692e(5) and (10) of the FDCPA by misrepresenting in its collection letter that it would seek authorization from the creditor to report its debtor to credit bureaus. The debt collector did not intend to so report, but merely made a threat in order to compel prompt payment, since regardless of whether the debt collector ever actually received authorization and did in fact report the creditor's debtors to credit bureaus, the creditor rarely reported debtors to credit bureaus.

XV. Creditor Escapes Liability

In Miller v. First USA, [FN31] an unknown person fraudulently used the plaintiff's social security number in December of 1997 to open a credit account with First USA. The perpetrator of the fraud used a different password from that used by plaintiff to open his two other First USA accounts. In September of 1998, the plaintiff discovered the existence of the fraudulently opened account. Subsequently, the plaintiff was denied credit because of unpaid charges attributable to that account.

The plaintiff sued First USA and Equifax Credit Information Services under the FCRA and also alleged state law causes of action. First USA moved to dismiss the complaint. First USA contended that the plaintiff's damages allegedly resulted from its reporting of incorrect information to a credit-reporting agency. It argued that the FCRA does not provide consumers a cause of action against mere suppliers of credit information. First USA also contended that the plaintiff's state claims were preempted by the FCRA because the plaintiff alleged damages arising out of the furnishing of credit information. The plaintiff argued that his claim was not based on First USA's act of supplying credit information, but instead was based on First USA's act which allowed an individual to open a credit account using his name.

The court ruled that if this were an FCRA claim, it would not lie against a mere furnisher of information like First USA and if it were a state law claim and it did not resemble a state common-law negligence claim, then it was preempted by the FCRA.

XVI. Just the Facts

In Turner v. Dencker Buick-Pontiac, Inc., [FN32] plaintiffs purchased a car from a car dealer and financed their purchase. The loan contract was assigned to a bank and, a few months later, the plaintiffs experienced difficulty with the car. They stopped making payments on the loan. The bank notified the credit bureau of the debt telephonically and the fact that the debt was disputed. However, the bank sent monthly electronic tape transmittals to the credit bureau that failed to disclose that the debt was still disputed. The bank allegedly decided not to incur the additional expense required to mark a dispute on an account in the electronic tape system.

The plaintiff sued the bank and alleged that the bank had violated Wisconsin law by its disclosure of the debt without disclosing the fact that the consumer disputed the debt. The bank, meeting the statutory definition of a debt collector, was held liable under a Wisconsin statute for failing to disclose that a debt is reasonably disputed.

XVII. Providing Erroneous Information After Discovering a Fraud

In Whitesides v. Equifax Credit Information Services, [FN33] the plaintiff learned that she was the victim of credit card fraud when she received notification of a delinquent account she did not open. The plaintiff contacted TRW to report fraudulent activity on her account. The plaintiff discovered an account with Nailco in December of 1996, when the *77 Bank of Louisiana, which extended the credit for the account, mailed her a notice. The plaintiff contacted the bank to report the account as a fraud and requested that it notify the consumer reporting agencies of the error. Citibank denied her application for credit or loans because of the continued reporting of fraudulent accounts on her report. As of January of 1999, the plaintiff's credit report continued to state that certain accounts were seriously past due and had been written off as a loss.

The plaintiff filed suit against the credit reporting agency and the bank. The plaintiff's claims were made under the FCRA as well under state law. One of the arguments made by the bank was that the FCRA's requirement that it conduct an investigation of disputed information was not applicable because it did not become effective until September 30, 1997. The bank's crediting back the delinquent Nailco account in April of 1997 was not enough, according to the court, because that action did not fulfill the obligations of 15 U.S.C. section 1681s-2(b), particularly if the bank continued to give erroneous information to consumer reporting agencies after discovering the credit fraud.

XVIII. Conclusion

This article contains summaries of cases illustrating risks under the FCRA to credit reporting agencies, creditors, and lawyers. The FCRA provides for a private right of action. Novel theories have been invoked in order to attempt to assert liability under the FCRA. Identity theft litigation is increasing. An early disposition of an FCRA case can be difficult and lawyers are not immune from liability. Risks under the FCRA also include liability arising from false pretenses in obtaining credit reports, actions by employees, the failure to disclose debts as disputed, and the failure to properly investigate disputed debts.

In addition, statute of limitations issues should be considered in light of the Supreme Court's decision in Andrews, holding that a general discovery rule does not govern section 1681p, which delineates the exceptional case in which discovery triggers the two-year limitation rule.

[FNa1]. David E. Worsley is a Partner at Chapman and Cutler, Chicago, Illinois. He has extensive experience in all aspects of consumer credit, including licensing, compliance, product development, and litigation. David received his B.A. in Political Science and Psychology from the University of Iowa in 1969 and his J.D. with distinction from the University of Iowa College of Law in 1973. David is a member of the Illinois, Iowa, American, and Chicago Bar Associations. He has served as the Chairman of the Law Department Management Sub-Committee of the American Financial Services Association. He has also served as the Vice Chairman and Chairman of the Consumer Credit Committee of the Chicago Bar Association. David is the Vice Chairman of the Legislative Committee of the Illinois Mortgage Bankers Association and is a member of the Board of Directors of that Association. David gratefully acknowledges the contributions to this article of Christian T. Jones, a partner at Chapman and Cutler, and Racquel Orenick, an Associate at Chapman and Cutler.

[FN1]. 99 F. Supp. 2d 918 (N.D. Ill. 2000).

[FN2]. 422 U.S. 66, 78 (1975).

[FN3]. Specifically, subsection (b) of 15 U.S.C. § 1681s-2.

[FN4]. See Ash, 422 U.S. at 78.

[FN5]. 1998 WL 433932 (N.D. Miss. 1998).

[FN6]. 90 F. Supp.2d 754 (E.D. Tx. 2000).

[FN7]. 57 F. Supp.2d 469 (W.D. Tn. 1999).

[FN8]. 2000 WL 1100440 (N.D. Ill. 2000).

[FN9]. 113 F. Supp.2d 1045 (S.D. Miss.).

[FN10]. 194 F.R.D. 244 (E.D. La. 2000).

[FN11]. 2000 WL 141258 (M.D. Fla. 2000).

[FN12]. 103 F. Supp. 2d 1296 (D. N.M. 2000).

[FN13]. 7 F. Supp.2d 1056 (C.D. Cal 1998), rev'd, 225 F. 3d 1063 (9th Cir. 2000), rev'd, 534 U.S. 19, 122 S. Ct. 441 (2001), on remand, 289 F. 3d 600 (9th Cir. 2001).

[FN14]. 225 F. 3d at 1066.

[FN15]. 996 F. Supp. 525 (E.D. Va. 1998).

[FN16]. CV 9503310 (Jefferson Cir. Ct. Aug. 27, 1999).

[FN17]. 682 N.Y.S. 2d 194 (N.Y. App. Div. 1998).

[FN18]. But see Patrick v. Union State Bank, 681 So. 2d 1364 (Ala. 1995), where the plaintiff sued a bank and alleged that the bank negligently allowed an impostor to open checking accounts in the plaintiff's name. The trial court entered summary judgment for the bank. The plaintiff appealed. The Supreme Court of Alabama ruled that the bank owed a duty of reasonable care to the person in whose name, and upon whose identification, an account was opened to ensure that the person opening the account was not an impostor.

[FN19]. 103 F. Supp.2d 1135 (E.D. Mo. 2000).

[FN20]. 77 F. Supp.2d 810 (W.D. Ky. 1999).

[FN21]. 152 F.3d 1007 (8th Cir. Ark. 1998).

[FN22]. 2000 WL 1310666 (N.D. Ill. 2000).

[FN23]. 994 F. Supp. 492 (S.D.N.Y. 1998).

[FN24]. 54 F. Supp.2d 788 (N.D. Ill. 1999).

[FN25]. 15 U.S.C. § 1681o.

[FN26]. 144 F.3d 961 (6th Cir. Mich. 1998).

[FN27]. 134 F.3d. 41 (2nd Cir. Conn. 1997).

[FN28]. 26 P.3d 148 (Or. 2000).

[FN29]. 195 F.R.D. 665 (C.D. Cal. 2000).

[FN30]. CCH Consumer Credit Guide ¶ 51, 221 (N.D. Ill. 1998).

[FN31]. No. C-2-99-0927 (S.D. Oh. Sept. 8, 2000).

[FN32]. 623 N.W. 2d 151 (Wis. Ct. App. 2000).

[FN33]. 125 F. Supp.2d 807 (W.D. La. 2000).